Administer > Administer NPS > Use Certificate Authority

Use Certificate Authority

NPS enables you to use certificates signed by a third-party certificate authority (CA). By using a thirdparty certificate authority, you can ensure secure communication between the NPS system and the browser used to access different parts of the NPS console.

To configure NPS to use a third-party CA:

  1. Enable the HTTPS Mode
  2. Generate the Third-Party CA Certificate

  3. Import the Third-Party CA Certificate

Task 1: Enable the HTTPS Mode

If you select the HTTPS mode of communication while running the nnmenableperfspi.ovpl script on the NNMi management server, NPS starts running in the HTTPS mode after the installation is complete. In that case, you need not perform this task.

If did not select the HTTPS mode of communication while running the nnmenableperfspi.ovpl script:

In a distributed deployment of NPS, perform this task on the UiBi Server.

  1. Log on to the NPS system as administrator or root.

  2. Run the following command:

    • On Windows: %ovinstalldir%\NNMPerformanceSPI\bin\configureWebAccess.ovpl -newport <port_number> -ssl
    • On Linux: /opt/OV/NNMPerformanceSPI/bin/configureWebAccess.ovpl -newport <port_number> -ssl

    In this instance, <port_number> is the port on which you want to run the NPS Business Intelligence Server.

  3. Restart the Business Intelligence Server by running the following commands:

    On Windows:

    1. %ovinstalldir%\NNMPerformanceSPI\bin\stopBI.ovpl

    2. %ovinstalldir%\NNMPerformanceSPI\bin\startBI.ovpl

    On Linux:

    1. /opt/OV/NNMPerformanceSPI/bin/stopBI.ovpl

    2. /opt/OV/NNMPerformanceSPI/bin/startBI.ovpl

Task 2: Generate the Third-Party CA Certificate

To generate the third-party CA certificate:

In a distributed deployment of NPS, perform this task on the UiBi Server.

  1. Log on to the NPS system as administrator or root.

  2. Run the following command:

    • On Windows: %ovinstalldir%\NNMPerformanceSPI\bin\runBIConfigGUI.ovpl
    • On Linux: /opt/OV/NNMPerformanceSPI/bin/runBIConfigGUI.ovpl

    The NNM iSPI Performance BI Configuration window opens.

  3. In the Explorer pane, click Security > Cryptography > Cognos.

  4. In the right pane, under the Signing Key Settings section, change the Signing key store password. Note down this new password.

  5. In the right pane, under the Encryption Key Settings section, change the Encryption key store password. Note down this new password.

  6. Close the NNM iSPI Performance BI Configuration window.

  7. Go to the following directory:

    • On Windows: %ovinstalldir%\nonOV\conos\bi\configuration
    • On Linux: /opt/OV/nonOV/cognos/bi/configuration

  8. Take a backup of the following files and directories:

    • cogstartup.xml
    • encryptkeypair/
    • signkeypair/

  9. Set the JAVA_HOME environment variable to the following directory:

    • On Windows: %ovinstalldir%\nonOV\jdk\hpsw
    • On Linux: /opt/OV/nonOV/jdk/hpsw

  10. Go to the following directory:

    • On Windows: %ovinstalldir%\nonOV\conos\bi\bin
    • On Linux: /opt/OV/nonOV/cognos/bi/bin

  11. Run the following commands:

    • On Windows:

      • ThirdPartyCertificateTool.bat -c -s -d "CN=<NPS_FQDN>,O=<org name>,C=<Country>" -rsignRequest.csr -D ../configuration/signkeypair -p <password_sign>

      • ThirdPartyCertificateTool.bat -c -e -d "CN=<NPS_FQDN>,O=<org name>,C=<Country>" -rencryptRequest.csr -D ../configuration/encryptkeypair -p <password_encrypt>

    • On Linux:

      • ./ThirdPartyCertificateTool.sh -c -s -d "CN=<NPS_FQDN>,O=<org name>,C=<Country>" -rsignRequest.csr -D ../configuration/signkeypair -p <password_sign>

      • ./ThirdPartyCertificateTool.sh -c -e -d "CN=<NPS_FQDN>,O=<org name>,C=<Country>" -rencryptRequest.csr -D ../configuration/encryptkeypair -p <password_encrypt>

    In this instance, <password_sign> is the password that you assigned in step 4; <password_encrypt> is the password that you assigned in step 5; <NPS_FQDN> is the fully qualified domain name of the NPS system.

    The above commands create the signRequest.csr and encryptRequest.csr files. Use these .csr files to obtain corresponding signRequest.cer and encryptRequest.cer files and the root certificate (ca.cer) from the third-party signing authority.

Task 3: Import the Third-Party CA Certificate

To import the third-party CA certificate into the Business Intelligence Server of NPS:

In a distributed deployment of NPS, perform this task on the UiBi Server.

  1. Log on to the NPS system as administrator or root.

  2. Go to the following directory:

    • On Windows: %ovinstalldir%\nonOV\conos\bi\bin
    • On Linux: /opt/OV/nonOV/cognos/bi/bin
  3. Place the signRequest.cer, encryptRequest.cer, and ca.cer files (created in the previous task) in this directory.
  4. Rename the signRequest.cerand encryptRequest.cer files to signCertificate.cer and encryptCertificate.cer.

  5. Run the following commands:

    • On Windows:

      • ThirdPartyCertificateTool.bat -i -s -r signCertificate.cer -D ../configuration/signkeypair -p <password_sign> -t ca.cer

      • ThirdPartyCertificateTool.bat -i -e -r encryptCertificate.cer -D../configuration/encryptkeypair -p <password_encrypt> -t ca.cer

      • ThirdPartyCertificateTool.bat -i -T -r ca.cer -D ../configuration/signkeypair -p <password_ca>

    • On Linux:

      • ./ThirdPartyCertificateTool.sh -i -s -r signCertificate.cer -D ../configuration/signkeypair -p <password_sign> -t ca.cer

      • ./ThirdPartyCertificateTool.sh -i -e -r encryptCertificate.cer -D../configuration/encryptkeypair -p <password_encrypt> -t ca.cer

      • ./ThirdPartyCertificateTool.sh -i -T -r ca.cer -D ../configuration/signkeypair -pNoPassWordSet

    In this instance, <password_sign> is the password that you assigned in step 4; <password_encrypt> is the password that you assigned in step 5.

  6. Go to the following directory:

    • On Windows: %ovinstalldir%\nonOV\conos\bi\configuration

    • On Linux: /opt/OV/nonOV/cognos/bi/configuration

  7. Undo the JAVA_HOME variable configuration that was set in step 9.

  8. Open the cogstartup.xml file with a text editor and make sure that the crn:parameter element contains the following content:

    <crn:parameter name="thirdPartyCA">
    <crn:value xsi:type="xsd:boolean">true</crn:value>
    </crn:parameter>

  9. Restart the Business Intelligence Server by running the following commands:

    On Windows:

    1. %ovinstalldir%\NNMPerformanceSPI\bin\stopBI.ovpl

    2. %ovinstalldir%\NNMPerformanceSPI\bin\startBI.ovpl

    On Linux:

    1. /opt/OV/NNMPerformanceSPI/bin/stopBI.ovpl

    2. /opt/OV/NNMPerformanceSPI/bin/startBI.ovpl

Send Help Center feedback